What is the CVSS score of EUVD-2026-50604?

EUVD-2026-50604 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50604?

Google Chrome on macOS (versions before 151.0.7922.72) contains a critical vulnerability (CVE-2026-17855, CVSS 9.6) that allows attackers who have already compromised the browser to bypass its…. A patch is available.

How to fix or mitigate EUVD-2026-50604?

Within 24 hours, inventory all macOS systems running Google Chrome and identify those on versions prior to 151.0.7922.72. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all affected macOS devices through your standard patch delivery mechanism (MDM, managed updates, or deployment tools). Within 30 days, complete deployment validation across all endpoints and ensure zero systems remain on vulnerable versions.

Google Chrome EUVD-2026-50604

| CVE-2026-17855 CRITICAL

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-f6mj-jpwj-95hj

Information Disclosure Google Race Condition

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a prior renderer compromise (PR:L) and winning a non-deterministic race (AC:H); a crafted page adds UI:R, and sandbox escape crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:25 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.

Technical ContextAI

The flaw is a CWE-362 race condition (concurrent execution using a shared resource with improper synchronization) inside Chrome's DevTools subsystem, which mediates privileged instrumentation and debugging interactions between the sandboxed renderer and the more-privileged browser process. Because DevTools bridges trust boundaries, a timing window where shared state is accessed without proper locking can be abused to violate the renderer sandbox that normally confines untrusted web content. The affected component is the Chromium/Blink browser engine as shipped in Google Chrome on macOS (CPE cpe:2.3:a:google:chrome), and the bug is platform-specific to the Mac build per the advisory. Sandbox escapes of this class are typically used as the second stage of an exploit chain, following an initial renderer-level memory-corruption or logic bug.

RemediationAI

Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome on macOS to 151.0.7922.72 or later and restart the browser to ensure the update is applied (verify via chrome://settings/help). This is delivered through the Chrome Stable channel auto-update; enterprises using managed/pinned deployments should push the updated build promptly. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As an interim compensating control until updated, reduce the attack surface that enables a renderer compromise (the required precondition): enable Enhanced Safe Browsing, deploy the site-isolation and strict-URL policies via enterprise policy, and restrict or disable developer-tools access with the DeveloperToolsAvailability policy - noting the trade-off that disabling DevTools impacts developers and web-app debugging workflows. These controls narrow the chain but are not substitutes for the patch.